EUVD-2026-117652

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...